GHSA-g63w-24cr-p3w6: Pi-hole: file:// adlist read check and curl can resolve different files
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pi-holeto a version that resolves this vulnerability.Fixed in 6.5
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Exploitation requires an administrator who can add adlists and can create both a symlink and a readable decoy file on the filesystem. It is therefore not an unauthenticated remote attack.
What is the impact if exploitation succeeds?
An attacker can cause curl to read a file that differs from the file validated by the readability check, including a root-only target. The stated impact is limited to disclosure of file contents; integrity and availability are not affected.
Are default installations affected?
The issue affects Pi-hole versions prior to 6.5, but exploitation additionally depends on administrative adlist access and the ability to place the required filesystem objects.
How can this be remediated?
Upgrade Pi-hole to version 6.5, which fixes the issue.